For years, Riot Games’ Vanguard anti-cheat system has stood as one of the most polarizing pieces of software in the PC gaming landscape. Since its 2020 debut, the kernel-level driver has been a constant presence for Valorant and, more recently, League of Legends players. Often criticized for its deep-seated access to system resources and its "always-on" nature, Vanguard has finally received a significant overhaul. In a move to balance aggressive cheat prevention with user privacy concerns, Riot has officially announced an "on-demand" mode for its security suite.
The Evolution of Vanguard: From Always-On to On-Demand
Historically, Vanguard was designed to be active from the moment a user pressed the power button on their PC. By launching alongside the Windows kernel during the boot process, the software aimed to intercept sophisticated cheats before they could ever hook into the game engine. While effective, this "omnipresent" approach sparked widespread debate regarding data privacy and the potential for system instability.
Under the new update, which began rolling out recently, Vanguard will shift to an on-demand model for a specific segment of the player base. Instead of running quietly in the background from startup to shutdown, the driver will only engage when a player launches Valorant or League of Legends. Once the game session concludes, the driver will terminate, effectively "ending its watch" until the next time the player chooses to queue for a match.
A Chronology of Controversy and Adaptation
To understand why this change is significant, one must look back at the introduction of Vanguard. When it launched, the gaming community expressed deep skepticism. Unlike traditional anti-cheat software that acts like a standard application, Vanguard’s kernel-level driver operates at "Ring 0"—the highest level of privilege in the Windows operating system. This allows the software to monitor hardware and software interactions at a level that, for many users, felt like an unnecessary invasion of privacy.
- 2020: Riot introduces Vanguard with the launch of Valorant. The community immediately questions the necessity of an always-on kernel driver.
- 2021-2023: As botting and sophisticated cheat software evolve, Riot maintains that the kernel-level approach is the only way to ensure competitive integrity. Meanwhile, other industry titans like Activision (Call of Duty) and HoYoverse (Genshin Impact) adopt kernel-level anti-cheats, though they typically operate only while the game is active.
- 2024: After years of internal development and collaboration with Microsoft, Riot announces the "Pre-Check" system, allowing for the transition to an on-demand model for systems meeting specific, high-security hardware requirements.
Understanding the "Pre-Check" Requirements
The transition to on-demand mode is not a blanket update for every user; it is a privilege tied to the security architecture of the individual PC. Riot has established a "Pre-Check" system that scans for modern security standards before allowing the driver to step back from its always-on requirement.
Approximately 35% of Riot’s player base already meets these stringent requirements. For these users, the change will occur automatically. However, for those who wish to enable this feature but haven’t yet, the technical barriers are significant. The system requires:
- Windows 11 (25H2 or later): The OS must be current to support the latest security protocols.
- UEFI Secure Boot: Ensures that the system firmware is not compromised by rootkits.
- TPM 2.0: A hardware-based security module that provides a foundation for trust.
- VBS (Virtualization-Based Security) and HVCI: These features use hardware virtualization to create an isolated, secure region of memory.
- IOMMU: Provides memory protection by ensuring peripherals do not access unauthorized areas of the system memory.
For many users, meeting these requirements may necessitate a dive into their BIOS/UEFI settings—a process that can be intimidating for casual users. Furthermore, roughly 3% of the player base currently operates on hardware that is physically incapable of meeting these modern security standards. For these individuals, the always-on Vanguard system will remain the status quo, ensuring they can still play, albeit without the new on-demand functionality.
Official Stance: Riot’s Rationale and Collaboration
The delay in providing an on-demand option was not a matter of choice, but a matter of technical necessity. According to Phillip Koskinas, the head of anti-cheat at Riot Games, the industry had to wait for the hardware and software ecosystems to mature.
"Microsoft and PC equipment manufacturers have long-recognized the need for cryptographic verification of boot processes," Koskinas stated in the official announcement. "The resulting oven-fresh security features require newer hardware components and newer versions of Windows."
Riot emphasizes that this update was made possible through direct collaboration with the Xbox OS Security Team at Microsoft. By working at the kernel level of the Windows operating system itself, Riot was able to find a way to maintain the same level of integrity without needing the Vanguard driver to be active during non-gaming hours. This partnership represents a shift in how game developers interact with the operating system, moving away from "brute force" security toward utilizing native, secure hardware features.
Implications for Competitive Integrity and the Future
What does this mean for the future of competitive gaming? The implications are twofold: one for the user experience and one for the ongoing arms race against game cheats.
The User Experience
For the average player, the immediate benefit is the reclamation of system resources. While modern PCs have plenty of RAM and CPU overhead, the psychological relief of knowing an anti-cheat isn’t "watching" the system when it’s not needed is substantial. Riot’s decision to allow players to "opt-in" by satisfying security checks turns a privacy concern into a tech-literacy challenge, which many enthusiasts will welcome.
The Arms Race
As Artificial Intelligence and machine-learning-based cheats become more prevalent, the threat model for developers is shifting. AI-based bots that don’t hook into the game code but instead read the screen and simulate mouse movements are notoriously difficult to detect. Riot has hinted that while they want to reduce friction for the average player, they will remain vigilant in high-stakes environments.
"Our trust segmentation will be surgical," Koskinas noted. "While we might add more checks to Pre-Check in the future, we plan on keeping things optional until you’re in the most competitive segments, on the strangest devices, or amongst the highest ranks."
This suggests that while the "on-demand" model is the new standard for the casual player, those competing at the professional level—or perhaps those playing on systems that appear suspicious to the server—may still be subjected to more aggressive monitoring.
Conclusion: A Balanced Future
Riot Games’ move to provide an on-demand Vanguard is a mature response to a years-long debate. By leveraging modern Windows security features, they have successfully bridged the gap between high-level security and user autonomy. While the requirements for the "Pre-Check" mode might seem daunting to the uninitiated, they represent a significant step toward a more secure and transparent computing environment for gamers.
For those who are satisfied with the current state of Vanguard or who simply do not wish to tinker with their BIOS, the update changes nothing. For everyone else, it provides a choice: update your security settings and enjoy a more streamlined experience, or continue as you were. In an industry where trust between the developer and the player is often fragile, Riot’s willingness to adapt and iterate on its most controversial tool is a positive development that may set a precedent for other developers operating in the competitive space.
